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Abstract 

Safety  testing  is  generally  done  on  very  small  numbers  of  munitions  for  reasons  of  cost. 
Therefore,  obtaining  high  levels  of  confidence  as  the  result  of  testing  requires  to  design  highly 
informative  and  reliable  tests  and  to  organize  them  into  rational  and  cost-effective  test 
programs. 

Any  individual  test  must  obviously  be  representative  of  the  threat  or  hazard  it  simulates,  but  it 
must  also  meet  other  conditions:  be  reproducible/reliable,  be  meaningful  and  informative  (i.e. 
allow  a  good  understanding  of  the  test  outcome)  and  be  transferable  (i.e.  allow  the  extension 
of  the  results  to  other  configurations  than  strictly  that  of  the  test).  These  requirements  are  not 
fully  compatible,  hence  the  need  for  compromises  which  may  not  always  coincide  with  the 
current  approach  to  standardized  tests,  because  this  approach  places  emphasis  on 
representativity  by  trying  to  stick  as  closely  as  possible  to  the  real  scenarios.  In  particular, 
transferring  results  from  a  given  test  to  other  configurations  can  only  be  done  by  coupling 
experimental  testing  with  mathematical  modeling.  This  is  true  for  "single"  events  such  as  fuel 
fire  or  single  bullet  impact,  and  still  more  for  "compound"  events  such  as  multiple  impacts. 

Test  programs  can  be  of  various  types:  "single  label"  or  "multiple  label"  when  their  purpose  is 
the  attribution  of  a  general  qualification  (e.g.  "Insensitive  Munition"),  or  "tailored"  to  the 
specific  needs  of  a  particular  munition  or  family  of  munitions.  Tailoring  test  programs 
requires  a  precise  analysis  of  all  the  occurrences  (both  environmental  and  combat-generated) 
likely  to  be  faced  over  a  whole  life  cycle,  but  it  enables  specific  threats  or  hazards  to  be 
considered  (or  eliminated  if  irrelevant),  thus  providing  higher  levels  of  confidence  for  lower 
costs. 

Introduction 

The  aim  of  any  type  of  statistical  testing  is  to  qualify  a  production  as  a  whole  from  the 
analysis  of  a  reduced  sampling,  with  the  highest  possible  level  of  confidence  in  the 
conclusions  drawn  from  test  results.  In  such  industrial  productions  as  machined  parts,  the 
definition  of  relevant  dimensional  and  mechanical  tests  is  easy,  and  the  definition  of  the 
representative  sampling  to  be  tested  and  of  the  tolerances  to  be  applied  is  a  science  per  se 
("chi  squared"  testing)  which  allows  the  calculation  of  confidence  levels  for  the  whole 
production.  As  far  as  safety  is  concerned,  the  munitions  industry  is  far  from  being  able  to 
derive  such  confidence  levels  as  the  result  of  testing,  for  two  main  reasons: 
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-  the  number  of  possible  variations  of  the  real  scenarios  with  respect  to  the  nominal 
configuration  of  a  given  test  is  virtually  infinite,  so  the  usual  probability  calculations 
can  not  be  applied; 

-  even  if  these  calculations  were  possible,  reaching  high  levels  of  confidence  would 
normally  require  samplings  with  very  large  sizes,  which  is  never  the  case  because 
safety  testing  is  generally  destructive,  hence  expensive. 

This  makes  it  all  the  more  necessary  to  design  highly  informative  tests  and  to  organize  them 
into  rational  test  programs. 

1  Criteria  for  the  design  of  safety  tests 

1. 1  General  approach 

The  first  step  of  any  test  definition  is  the  identification  of  all  possible  threats/hazards  which 
may  occur  during  the  whole  life  of  a  munition.  These  may  involve 

-  either  single  events  (e.g.  single  fragment  or  bullet  impact,  e.g.  fuel  fire); 

-  or  compound  events  (e.g.  sequential  events  such  as  multiple  fragment  or  bullet 
impact). 

As  long  as  mathematical  models  did  not  exist,  the  only  way  of  assessing  the  behavior  of  a 
given  munition  to  one  of  these  threats/hazards  was  to  simulate  it  experimentally  by  a  test.  This 
is  certainly  a  good  approach  provided  the  test  is  carefully  selected  so  as  to  be: 


(a)  REPRESENTATIVE  of  the  corresponding  threat  (e.g.,  when  simulating  fragment 
impact, 

select  a  chunky  cylinder  rather  than  a  long  rod  as  the  impacting  projectile); 

(b)  INFORMATIVE  and  MEANINGFUL,  i.e.  permitting  the  understanding  of  the  test 
outcome  (e.g.,  if  a  detonation  occurs  in  a  warhead,  understand  where  and  why  a 
reaction 

started  and  how  it  built  up  into  a  detonation); 

©  REPRODUCIBLE  per  se,  hence  RELIABLE  (e.g.  avoid  modes  of  projectile 
penetration 

which  result  in  random  variations  from  one  execution  to  another  of  the  same  test); 

(d)  TRANSFERABLE,  i.e.  permitting  an  extension  of  the  test  outcome  to  other 
configurations  than  strictly  that  of  the  test. 


1.2  Conflicts  between  different  criteria 


So  far,  the  general  tendency  has  been  to  place  emphasis  essentially  on  the  first  criterion  above 
-  representativity  -  by  trying  to  stick  as  closely  as  possible  to  the  real  scenarios  (e.g. 
simulating  bullet  impact  with  the  impact  of  a  real  bullet  on  a  real  munition);  but  this  is 
sometimes  done  at  the  expense  of  the  other  three  requirements  above: 


-  at  the  expense  of  (b)  because  most  tests  on  real  munitions  are  done  empirically 
without 

sufficient  instrumentation  to  detect  and  follow  with  due  precision  how  events  occur; 

-  at  the  expense  of  ©  because,  in  tests  such  as  bullet  impact,  the  penetration  of  the 
bullet  often  results  in  random  instabilities  which  may  totally  alter  the  result  of  the  test; 

-  at  the  expense  of  (d)  because  the  choice  of  "realistic"  tests  generally  results  in 
complex  geometries  which  complicate  modeling,  thus  also  complicating  the  extension 
of  the  results  from  one  configuration  to  another. 

This  problem  had  already  been  mentioned  in  the  former  DDBSB  seminar(1)on  such  examples 
as  bullet  impact  and  cookoff.  For  clarity,  the  same  examples  are  re-used  here  and  analyzed  in 
more  detail  in  Fig.  1,  2  and  3. 

1.3  Be  informative  and  meaningful 

The  upper  part  of  Fig.  1  illustrates  the  problem  of  understanding  the  outcome  of  a  fuel  fire  test 
on  an  intregrated  warhead  (i.e.  with  a  built-in  fuzing  system  F).  If  the  warhead  detonates  after 
a  certain  time  tin  the  fire,  there  is  one  undisputable  conclusion:  this  munition  does  not  meet  a 
"no-detonation"  requirement.  However,  the  next  obvious  question  for  the  munition  developer 
is  "What  should  I  do  to  correct  this  situation?".  But  how  can  anybody  answer  this  question 
with  just  a  pass-or-fail  test  outcome,  without  adequate  instrumentation  to  understand  what 
happened?  In  this  particular  example: 

-  did  the  detonation  start  in  the  high  explosive  HE,  exposed  to  a  very  high  temperature 
because  in  contact  with  the  flame  through  a  thermally  conductive  metal  case,  or  did  it 
start  in  the  fuzing  system  F,  better  thermally  protected  but  more  sensitive? 

-  in  any  case,  what  was  the  temperature  when  the  reaction  started? 

The  impossibility  of  answering  these  questions  means  that  a  costly  test  has  been  done  for 
nothing;  therefore  it  may  be  worth  increasing  its  cost  slightly  if  this  makes  it  usable.  One  way 
of  reaching  this  result  is: 

-  organizing  the  test  so  as  to  provide  more  information,  in  particular  by  measuring 
temperatures  where  they  really  matter  (i.e.  in  the  energetic  material)  and  not  just  where 


they  are  of  easy  access  (i.e.  in  the  flame,  as  is  usually  done); 


-  breaking  down  the  all-up  warhead  into  homogeneous  elements  and  testing  these  elements 
separately,  although  in  a  coordinated  manner. 

This  result  can  be  achieved  by  a  two-step  test,  as  follows: 

-  in  the  first  step,  the  warhead  is  tested  with  its  normal  HE,  but  after  replacing  its  fuzing 
system  F  with  a  case  of  identical  thermal  characteristics  equipped  with  temperature 
gauges  so  as  to  obtain  a  temperature  history  T(t)  during  the  fuel  fire; 

-  in  the  second  step,  the  fuzing  system  alone  is  submitted  to  that  temperature  history  in 
a  separate  oven. 

Comparing  the  times  to  reaction  t,  and  t2(or  the  absence  of  a  reaction)  in  each  step  makes  it 
possible  to  determine  which  is  the  weak  element  in  the  system.  In  addition,  knowing  at  what 
temperatures  these  events  occurred  makes  it  possible  to  study  remedial  actions,  either  by 
thermal  shielding  or  by  modification  of  the  energetic  materials. 

Incidentally,  when  a  fuel  fire  test  has  been  set  up  to  last  20  minutes,  what  valuable 
information  can  it  provide  if  the  munition  reacts  after  2  minutes?  If  the  munition  detonates  it 
may  blow  out  the  flame;  but  if  it  reacts  only  mildly  and  partially,  how  is  it  possible  to  know 
what  was  left  of  it  immediately  after  the  reaction  if  it  is  only  recovered  after  18  more  minutes 
of  exposure  to  fire? 

1.4  Be  reproducible/reliable 

The  left-hand  part  of  Fig.  2  illustrates  another  problem:  the  reliability  of  the  results  of  a  bullet 
impact  test.  This  test  is  done  using  a  specified  type  of  bullet  at  a  specified  velocity  v,  aiming 
at  a  given  point  of  the  munition  so  as  to  hit  it  exactly  along  a  diameter  (without  off-centering) 
in  a  given  cross-section  plane.  In  addition,  it  is  generally  assumed  that  the  bullet  exhibits  no 
yaw/pitch  at  impact,  so  the  configuration  is  fairly  symmetrical.  But  how  can  anyone  be  sure  of 
all  these  assumptions  with  just  a  poor  visualization  of  the  impact  by  means  of  a  medium- 
speed  camera  at  a  long  distance?  This  question  is  particularly  important  because,  if  any  of 
these  assumptions  is  wrong,  the  configuration  is  no  longer  symmetrical  and  the  bullet  is  likely 
to  tumble  in  a  random  manner  within  the  munition.  Small  variations  of  the  test  configuration 
can  then  lead  to  considerable  differences  between  two  extreme  situations: 

-  if  the  bullet  tumbles,  it  strongly  damages  the  energetic  material  (thus  producing  much 
surface  area)  and  it  may  remain  within  this  material  as  a  very  hot  slug  (thus  igniting  it); 
given  the  surface  area,  this  combustion  will  then  be  very  violent,  all  the  more  so  as  the 
combustion  products  can  only  escape  through  the  one  entrance  hole  of  the  bullet; 

-  conversely,  if  the  bullet  remains  stable,  it  may  perforate  the  munition  from  side  to  side, 
thus  opening  two  holes  in  the  case  instead  of  one,  producing  less  physical  damage  than 


above  in  the  energetic  material  and  depositing  less  thermal  energy:  this  energy  may  be 
insufficient  to  ignite  the  material,  and  even  if  it  does,  combustion  will  occur  in  a  material 
with  less  surface  area  and  with  two  vents  for  the  evacuation  of  the  combustion  products. 

Given  this  considerable  influence  of  random  variations,  what  level  of  confidence  can  be 
placed  in  the  test  result? 

1.5  Be  transferable 

Another  paper  presented  at  this  seminar-2'  shows  that  the  level  of  confidence  of  pass/fail  tests 
is  very  poor  in  general  because  they  are  very  little  informative,  and  still  poorer  in  the  case  of 
bullet  impact  because  they  are  unreliable:  these  conclusions  require  special  attention  because 
they  are  a  matter  of  concern. 

Yet,  even  if  this  level  of  confidence  were  equal  to  1,  the  problem  of  transferability  would 
remain:  if  the  munition  does  not  react  to  the  bullet  in  the  impact  test  above,  this  just  means 
that  it  does  not  react  to  that  particular  bullet  hitting  it  in  that  particular  geometry  with  that 
particular  velocity,  i.e.  in  a  configuration  having  a  zero  probability  of  occurrence  in  the 
absence  of  specified  tolerances.  There  is  an  infinite  number  of  possible  variations  of  the 
relevant  parameters  between  the  configuration  of  the  test  and  those  of  real  scenarios:  not  only 
random  variations  as  described  above,  also  deterministic  variations  such  as  the  nature  and 
velocity  of  the  bullet,  or  its  impact  trajectories  (a  few  possible  trajectories  are  represented  on 
Fig.  2,  but  they  all  are  located  in  meridian  planes  and  normal  to  the  munition  axis,  while  skew 
impacts  are  just  as  likely  in  real  scenarios,  and  never  studied  experimentally).  So,  what  allows 
testers  to  derive  a  general  conclusion  such  as  "this  type  of  munition  is  bullet-proof",  i.e.  to 
extend  the  result  from  that  particular  test  to  all  real  scenarios? 

A  possible  approach  to  a  more  general  answer  is  to  select  a  test  configuration  corresponding 
to  a  "worst  case"  scenario,  but  there  are  many  possible  definitions  of  such  scenarios: 

-  one  possible  way  of  "worsening"  the  threat  is  to  increase  the  caliber  and  velocity  of  the 
bullet  up  to  the  threshold  where  its  impact  generates  a  prompt  detonation; 

-  however,  unless  this  threshold  is  reached,  the  easiest  way  to  "worsen"  the  threat  is 
just  the  contrary,  i.e.  decreasing  the  bullet  velocity,  because  the  probability  for  this 
bullet  to  tumble  and  to  remain  within  the  munition  is  all  the  higher  as  its  velocity  is 
lower; 

-  anyhow,  whatever  the  velocity  of  the  bullet,  there  is  always  a  "worse-worst  case" 
scenario:  this  is  hitting  the  fuze. 

Therefore,  one  of  the  drawbacks  of  the  current  approach  to  purely  empirical  safety  testing  is 
to  give  a  dangerous  impression  of  universality  of  the  responses  -  e.g.  the  temptation  of 
declaring  "this  munition  is  bullet-proof"  after  two  successful  tests  done  in  one  particular 
configuration  -  while  the  response  to  a  threat  depends  on  the  exact  configuration  of  the  real 


stimulus.  So  the  only  way  of  assessing  safety  is  to  extend  results  from  one  configuration  to 
another,  and  the  only  universal  way  to  this  end  is  using  a  mathematical  model,  as  technology 
now  permits  and  as  is  already  usual  -  for  obvious  reasons  -  in  the  case  of  nuclear  munitions. 

1.6  Case  of  sequential  events. 

All  the  examples  considered  so  far  refer  to  "single"  events.  In  the  case  of  "compound"  events 
(e.g.  multiple  bullet  impact  instead  of  single  impact),  it  is  still  more  difficult  to  understand  the 
outcome  of  purely  empirical  tests,  and  it  is  very  unlikely  that  this  outcome  may  be  extended 
to  other  than  the  nominal  test  configuration,  given  the  number  of  additional  parameters  likely 
to  influence  it.  Fig.  3  considers  two  such  parameters  in  a  double  impact: 

-  the  time  At  between  the  two  impacts; 

-  the  distance  Az  between  the  two  impact  points. 

If  the  first  impact  does  not  generate  a  chemical  reaction,  it  has  at  least  a  mechanical  effect:  it 
produces  a  cavitation  zone  in  its  wake,  surrounded  by  a  zone  of  rubble,  then  by  a  fractured 
zone.  It  has  been  shown  that  mechanically  damaged  energetic  materials  were  much  more 
sensitive  to  impacts  than  the  same  materials  if  undamaged(3),  so  if  the  second  impact  takes 
place  within  the  rubble  or  the  fractured  zone,  it  may  initiate  a  reaction  which  had  not  occurred 
with  the  first  impact.  The  nature  and  violence  of  the  reaction  then  depend  on  the  zone 
impacted,  hence  on  the  distance  Az;  and  since  the  boundaries  of  the  damaged  zones  and  the 
resulting  surface  area  are  functions  of  time,  the  outcome  of  the  second  impact  may  also 
depend  on  At ,  although  to  a  smaller  extent. 

This,  again,  raises  two  different  problems: 

-  the  reproducibility  of  the  test  per  se:  At  is  of  easy  experimental  access,  but  what 
about  Az?  Who  can  tell  for  sure  where  the  second  bullet  hit  the  munition  if  this  was 
destroyed  by  the  reaction? 

-  the  possibility  of  extending  the  results  to  other  scenarios:  even  assuming  both  At 
and  Az  to  be  perfectly  known  in  the  test,  and  all  other  factors  remaining  constant,  how 
can  it  be  stated  that  the  result  would  remain  the  same  for  any  double  impact,  i.e.  with 
different  values  of  these  parameters? 

As  in  the  example  of  the  fuel  fire  in  Fig.  1,  understanding  what  happens  in  a  compound  event 
implies  to  break  it  down  into  a  sequence  of  single  events,  e.g.: 

-  recover  and  characterize  of  the  energetic  material  as  damaged  by  the  first  impact 
(even  if  this  is  done  after  a  time  At  which  is  virtually  infinite); 


-  make  a  single  impact  in  this  material  with  different  degrees  of  damage,  as  found  at 
various  distances  Az  from  the  first  impact. 


The  number  of  relevant  parameters  in  this  sequence  of  events  makes  it  all  the  more  necessary 
to  utilize  models. 


2.  Use  of  Mathematical  Models 

2.1  Basic  approach 

Mathematical  modeling  has  been  used  in  safety  testing  for  many  years  in  other  fields  than 
munitions.  When  engineers  built  a  bridge  and  wanted  it  to  resist  a  certain  load,  they  did  not 
use  full  scale  testing  as  a  development  tool:  as  soon  as  materials  resistence  became  a  science, 
the  normal  way  of  ensuring  safety  was  (as  shown  in  the  upper  half  of  Fig.  4): 

-  to  achieve  a  mathematical  model  of  the  bridge,  incorporating  such  parameters  as  elastic 
moduli  or  ultimate  strengths  of  the  materials  to  be  used; 

-  to  derive  the  values  of  these  parameters  from  simple  stress-strain  experiments; 

-  to  validate  the  model  with  other  experiments,  closer  to  the  final  geometry  but  still 
simple  enough  to  allow  easy  calculations; 

-  to  use  this  validated  model  to  design  the  bridge; 

-  to  limit  the  full-scale  tests  on  the  bridge  itself  to  a  verification  of  the  calculations  (e.g. 
by  measuring  its  response  to  concentrated  loads  within  its  elastic  limits). 

2.2  Transfer  to  munition  safety  testing 

In  munition  testing,  mathematical  models  are  more  recent  and  still  not  perfect  (e.g.  bullet 
penetration  is  generally  simulated  in  purely  axi-symmetrical  2-D  configurations  which  do  not 
take  into  account  the  possibility  of  tumbling),  sometimes  because  of  a  lack  of  understanding 
of  some  phenomena  (e.g.  the  violence  of  reaction  to  slow  cookoff).  This  proves  that  we  are 
still  far  from  a  status  where  all  problems  could  be  solved  without  any  experiment,  thanks  to 
ab-initio  mathematical  codes.  But  a  number  of  semi-empirical  codes  are  already  available, 
which  can  be  used  as  tools  enabling  the  transfer  of  experimental  results  from  the  one 
configuration  to  another.  This  approach  then  leads  to  an  important  difference  with  the  current 
one: 


-  in  the  current  approach,  tests  are  supposed  to  provide  a  direct  and  general  response 
by  "yes"  or  "no"  to  the  question  "Is  this  munition  safe  with  respect  to  this 
threat/hazard?"; 

-  in  the  semi-mathematical  approach  as  described,  tests  are  designed  to  provide 
experimental  inputs  to  the  model  and  to  validate  it;  once  this  is  done,  it  is  up  to  the 
model  to  answer  the  yes-or-no  question  in  each  particular  configuration. 


To  this  end,  tests  must  be  designed  in  a  slightly  different  way  because  this  approach  modifies 
the  order  of  priority  between  the  four  criteria  previously  described: 

-  the  highest  priorities  for  the  test  are  to  be  REPRODUCIBLE/RELIABLE  in  order  to 
ensure  the  validity  of  the  experimental  inputs,  and  INFORMATIVE/MEANINGFUL 
in  order  to  allow  the  validation  of  the  model; 

-  by  contrast,  there  is  no  need  for  the  test  to  be  TRANSFERABLE  by  itself,  since  the 
extension  of  its  results  from  one  configuration  to  another  is  achieved  by  the 
mathematical  model  with  much  more  reliability  than  by  any  purely  experimental 
method; 

-  as  a  consequence,  the  test  does  not  even  need  to  be  strictly  REPRESENTATIVE  of 
the  threat/hazard,  since  this  threat/hazard  is  just  one  among  the  many  configurations 
which  can  be  simulated  by  the  model. 

2.3  Illustration  on  bullet  impact 

The  lower  half  of  Fig.  4  provides  a  typical  illustration  of  the  method: 

-  when  simulating  a  bullet  impact  threat,  replace  the  bullet  with  a  sphere,  which  is  less 
representative  but  whose  penetration  is  more  reproducible  (no  tumbling  or  other 
random  behavior)  and  perform  the  tests  with  sufficient  visualizations  and 
instrumentation  so  that  the  values  of  all  relevant  parameters  are  adequately  measured; 

-  build  a  mathematical  model  able  to  compute  the  impact  and  penetration  of  a 
projectile  of  any  size  and  shape  (in  particular  spherical  or  pointed); 

-  derive  the  values  of  the  main  parameters  of  the  model  from  tests  done  in  very  simple 
geometries  (e.g.  plane  targets),  then  validate  the  model  by  means  of  tests  done  in  more 
elaborated  geometries  (e.g.  generic  munitions,  which  are  more  representative  but 
simple  enough  to  give  meaningful  results); 

-  use  the  model  to  simulate  the  behavior  of  a  real  munition,  not  only  in  the  particular 
configuration  of  the  test  but  in  any  other  as  necessary; 

-  possibly  use  the  model  to  define  the  most  adequate  configurations  for  final  reception 
testing  on  the  munition  itself,  if  this  is  estimated  necessary  (e.g.  "worst-case"  scenarios 
having  reasonable  probabilities  of  occurrence). 

2.4  Illustration  on  cookoff 

Another  illustration  concerns  the  cookoff  test.  For  the  sake  of  representativity,  a  fuel  fire  is 
generally  simulated  with  a  fuel  fire,  with  all  the  drawbacks  presented  above,  not  to  mention 
environmental  considerations.  By  comparison,  a  gas  fire  is  cleaner  and  its  outcome  can  be 


much  more  informative: 


-  because  the  fire  can  stopped  immediately  after  the  event; 

-  and  because  its  flame  is  transparent. 

Now,  precisely  because  its  flame  is  transparent,  a  gas  fire  differs  from  a  fuel  fire:  gas  flame 
heating  is  mainly  convective  while  fuel  flame  heating  is  mainly  radiative(4>.  However  this 
ceases  to  be  a  problem  if  a  mathematical  model  is  used.  Indeed,  as  already  mentioned,  what  is 
important  in  the  understanding  of  the  event  is  not  the  temperature  somewhere  in  the  flame  but 
the  temperature  of  the  energetic  material  at  the  time  of  reaction.  This  temperature  is  very 
difficult  to  measure  directly,  but  it  can  be  accurately  computed  out  of  indirect  experimental 
inputs  provided  these  are  of  good  quality  and  their  boundary  conditions  well  defined,  which  is 
certainly  easier  to  obtain  with  a  gas  fire  than  with  a  fuel  fire. 


Since  fuel  fires  might  be  banned  in  the  near  future  for  environmental  reasons,  it  would 
be  advisable  to  start  preparing  an  alternative  solution  now  rather  than  have  to  improvise  one 
later:  this  is  the  rationale  already  adopted  many  years  ago  in  the  case  of  nuclear  munitions. 

2.5  Applicability  of  the  method 

All  this  defines  a  semi-mathematical  approach  to  the  problem  of  safety  testing.  Most  of  its 
elements  already  exist,  in  particular  mathematical  models  (even  if  they  still  require  some 
improvements),  but  the  overall  approach  is  not  yet  usual.  However,  it  is  partly  implicit  in  such 
rationales  as  the  French  approach  to  safety  analysis.  In  this  approach,  the  safety  of  a  munition 
is  not  necessarily  assessed  by  means  of  direct  testing:  it  must  be  "demonstrated"  by  any 
means,  including  the  utilization  of  results  from  other  tests  done  in  previous  phases  of  the 
development  (on  all-up  munitions  or  components,  on  mockups  or  even  on  bare  energetic 
materials).  Since  the  key  problem  in  this  approach  is  the  transferability  of  results  from  other 
tests,  this  requires  a  combination  of  experimental  testing  and  mathematical  modeling. 

3.  Criteria  for  the  definition  of  test  programs 

Assuming  each  individual  test  to  be  defined,  designed  and  conducted  as  previously  indicated 
(in  relation  with  the  corresponding  threat),  it  is  then  necessary  to  define  a  coherent  test 
program. 

3. 1  In  early  development  chases 

In  the  early  phases  of  the  development  of  a  munition  or  family  of  munitions,  and  still  more  if 
the  aim  of  the  tests  is  to  seek  improvements  to  current  technologies  applicable  to  all  future 
munitions,  standardized  specifications  are  not  yet  mandatory,  so  test  programs  can  be  defined 
pragmatically.  Actually,  they  must  be  defined  in  an  iterative  mode  because  the  outcome  of 
each  test  may  lead  to  modifying  its  design  and  because  the  experience  gained  from  each  test 


may  lead  to  taking  new  elements  into  account.  In  addition,  it  is  advisable  to  apply  these  tests 
to  generic  munitions  rather  than  to  real  munitions  because: 

-  generic  munitions  normally  have  simpler  geometries,  hence  they  are  easier  to  model 
and  to  instrument; 

-  they  are  instrinsically  cheaper  than  real  ones; 

-  using  them  allows  the  tests  (hence  the  resulting  modifications  of  the  design,  if  any)  to 
be  carried  out  earlier  in  the  process,  thus  reducing  the  overall  development  cost, 
especially  if  some  of  their  results  can  be  transfered  to  the  final  munition  by 
mathematical  means. 

3.2  In  the  qualification  chase 

In  the  final  phase  of  a  development,  this  pragmatism  is  no  longer  possible  because  the 
qualification  of  a  munition  is  subordinated  to  mandatory  test  programs.  However,  there  are 
several  possible  approaches  to  such  test  programs,  whose  implications  are  not  only  technical 
but  also  political®: 

-  the  "single  label"  approach,  where  the  acquisition  of  a  given  label  (e.g.  the  IM  label 
in  the  US  Navy  MIL-STD  2105,  e.g.  the  EIDS  label  in  the  UN  "Orange  Book")  is 
subordinated  to  the  execution  of  all  the  tests  appearing  in  a  standard  list  and  to  the 
respect  of  the  pre-defined  levels  of  reaction; 

-  the  "multiple  label"  approach,  where  all  the  tests  remain  mandatory  but  their  outcome 
results  in  a  categorization  within  a  graded  list  of  levels  (e.g.  UN  hazard  divisions,  e.g. 
the  French  approach  to  MURAT  specifications); 

-  the  "tailored"  approach,  where  the  test  program  itself  is  tailored  to  specific  needs, 
either  by  eliminating  some  tests  and/or  by  adapting  them  case  by  case,  and/or  by 
arranging  them  in  such  an  order  that  the  outcome  of  each  test  allow  to  take  a  decision 
as  to  the  relevance  of  the  remaining  ones. 

3.3  Approach  to  "tailored"  programs 

The  revised  version  MIL-STD  2105B  paves  the  way  for  the  adoption  of  tailored  programs, 
and  so  does  the  draft  NATO  STANAG  4439  on  Insensitive  Munitions.  Defining  such  a 
"tailored"  test  program  applicable  to  a  particular  munition  or  family  of  munitions  requires 
additional  inputs,  in  particular  from  operations  research,  as  for  the  tests  by  themselves. 

-  the  identification  of  all  likely  threats,  both  environmental  (i.e.  accidents  which  may 
occur  during  transportation  and  storage)  and  combat-generated  (e.g.  projectile 
impacts); 


-  the  evaluation  of  their  probability  of  occurrence  in  different  configurations  (e.g.  type 
and  velocity  of  projectile  and  impact  geometry); 

-  a  hazard  assessment,  i.e.  the  evaluation  of  the  consequences  if  one  of  these  threats  results  in  a 
reaction  of  a  given  type; 

-  the  definition  of  those,  among  the  likely  threats  above,  which  deserve  sufficient 
statistical  interest  to  be  applied  specific  tests  (the  "interest"  criterion  being,  for 
example,  the  probability  of  occurrence  multiplied  by  the  severity  of  the  resulting 
reaction,  if  any),  without  excluding  further  re-definitions  as  feedbacks  from  the  first 
results. 

This  approach  is  covered  by  a  separate  presentation  in  this  seminar(6),  which  puts 

emphasis  on  a  particular  category  of  munitions. 
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Fig.  4  -  Coupling  Experimental  Testing 
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